// in such cases we return early, only doing SQL/JS escaping
if (isset($params['skip']) and $params['skip']) {
if (isset($escape) and ($escape == 'sql')) {
- $text = mysql_escape_string($text);
+ $text = mysql_real_escape_string($text);
}
if (isset($escape) and ($escape == 'js')) {
$text = addcslashes($text, "'");
// escape SQL if we were asked for it
if (isset($escape) and ($escape == 'sql')) {
- $text = mysql_escape_string($text);
+ $text = mysql_real_escape_string($text);
}
// escape for JavaScript (if requested)